ISO 27001 Secure Areas: Design, Operation and Audit Evidence

A secure area is a physical space where unauthorised access, observation, interference or damage could affect important information or services. It might be a server room, records archive, payment operations room, security operations centre, laboratory, network closet or restricted part of an office. The label matters less than the risk and the protection that operates around it.

ISO/IEC 27001:2022 does not prescribe one building design. Annex A provides a set of physical controls, while the organisation decides which controls are necessary through risk treatment. A defensible design connects the information and service at risk to zones, entry controls, monitoring, working rules and evidence.

Define the area from the inside out

Begin with what the space protects. Identify the processes, information, equipment and people within it, then assess the consequences of disclosure, alteration, interruption, theft or physical damage.

Record:

• the business and information owner;
• activities performed in the area;
• information classifications present;
• equipment and records located there;
• normal occupants and authorised visitors;
• operating hours and unattended periods;
• environmental and utility dependencies; and
• adjacent public, shared or third-party spaces.

An area should not be declared secure merely because its door locks. The boundary must make sense for the assets and threats. A network cabinet accessible from a public corridor may require a protected enclosure even if the wider office is controlled. A restricted team room may require privacy protection but not the resilience measures expected in a critical equipment room.

Build layered physical zones

Use zones to increase protection as sensitivity and impact rise. A common arrangement includes public space, reception-controlled space, general working areas, restricted business areas and high-security rooms. The names and number of levels should fit the organisation.

For each boundary, define:

• who may cross it;
• how identity and authorisation are verified;
• which items may enter or leave;
• whether visitors need escort;
• how access is recorded;
• what happens outside normal hours; and
• how emergency access works.

Layering reduces reliance on one door or one person. A failed reception control should not automatically expose the most sensitive room. Equally, excessive layers can obstruct operations and encourage unsafe workarounds. Test whether authorised people can perform their duties, including during incidents.

The ISO 27001 data-centre security guide gives more detail for dedicated facilities. Secure-area principles also apply to smaller offices and distributed operational sites.

Map the current Annex A controls

Several ISO/IEC 27001:2022 controls may contribute to secure-area protection:

• A.7.1 addresses physical security perimeters;
• A.7.2 addresses physical entry;
• A.7.3 addresses securing offices, rooms and facilities;
• A.7.4 addresses physical security monitoring;
• A.7.5 addresses physical and environmental threats;
• A.7.6 addresses working in secure areas;
• A.7.7 addresses clear desk and clear screen; and
• A.7.8 addresses equipment siting and protection.

These are not a required bundle for every room. Determine applicability and document the decision through risk treatment and the Statement of Applicability. Use the free Annex A control lookup to review related controls, then confirm the full wording in the licensed standards.

Design the perimeter

A perimeter may be a wall, floor, ceiling, barrier, cabinet or combination. Inspect it as a continuous boundary. Doors receive attention, but weak ceilings, shared risers, loading areas, windows and removable panels can create unintended routes.

Consider construction strength, fire resistance, visibility, utility penetrations, emergency exits and the ability to detect interference. Doors should close reliably, and emergency release arrangements should satisfy safety requirements without leaving uncontrolled access.

Document why the chosen boundary is adequate. A drawing can show the intended zone, but a walk-through confirms whether later building changes have opened gaps.

Control entry and exit

Access should be approved according to role and business need. Link physical-access provisioning to joining, role change, temporary assignment and departure. Avoid generic shared badges where individual accountability is required.

Operating measures may include:

• identity badges or biometric factors;
• role-based door groups;
• time and location restrictions;
• visitor identity verification;
• escorts and temporary credentials;
• anti-passback or tailgating controls where justified;
• periodic access review; and
• rapid revocation after loss or termination.

Biometric systems introduce privacy and legal considerations. Select them only after evaluating necessity, proportionality, data handling and local law. A sophisticated device does not compensate for weak approval or badge sharing.

Control movement out of the area as well. Assets, paper records and removable media may require authorisation or logging. Emergency evacuation must remain possible; security cannot obstruct life safety.

Monitor the area proportionately

Monitoring can deter, detect and support investigation. Options include alarms, door events, video, security patrols, tamper indicators and environmental sensors. Define what each measure is expected to detect, who receives the alert and how quickly a response is required.

Retention should reflect investigation needs, privacy law, storage risk and contractual duties. Restrict access to recordings and logs. Test camera views, timestamps, alert routing and recovery rather than assuming installation proves effectiveness.

Review alerts and unusual access patterns. A door-held-open alarm that is routinely ignored is not an effective control. Link incidents and corrective actions to the source record.

Establish working rules

People authorised to enter still need rules for conduct. Depending on risk, rules may cover:

• photography and recording;
• personal devices and removable media;
• confidential conversations;
• unattended work and screen locking;
• prohibited food, liquids or hazardous materials;
• escort and visitor supervision;
• maintenance and cleaning access;
• emergency activity; and
• reporting suspicious behaviour or damage.

Rules should be visible or readily available without publicly advertising sensitive details. Provide personnel with the resources to comply, such as storage, approved devices and a practical visitor process.

The clear-desk and clear-screen guide explains how workspace protection supports secure areas.

Protect equipment and supporting services

Secure entry does not address heat, water, fire, dust, unstable power or exposed cabling. Inspect environmental threats and supporting utilities together with facilities specialists. The equipment siting and protection guide provides a risk-based method for A.7.8.

Use the free ISO 27001 risk score calculator to structure initial prioritisation, but incorporate service criticality, legal duties and site knowledge before deciding controls.

Separate design evidence from operating evidence

Design evidence explains why the secure area should work:

• physical risk assessment and zoning rationale;
• approved floor plan or boundary description;
• access roles and approval criteria;
• visitor, monitoring and working rules;
• alert response and emergency procedures; and
• system configuration and retention decisions.

Operating evidence shows that it does work:

• current authorised-user lists;
• sampled approvals, changes and revocations;
• entry logs and visitor records;
• access-review results;
• alert tests and investigations;
• maintenance and inspection records;
• exception approvals; and
• corrective-action closure.

Protect this evidence. Detailed plans, access populations and security-system configurations are sensitive and should not be unnecessarily copied into audit working papers.

Audit the whole path

Select secure areas by risk, location and type. Include a high-impact room, an ordinary restricted office, an area operated by a supplier and a recently changed space where relevant.

For each sample:

1. confirm the owner and purpose;
2. trace the risk assessment to selected controls;
3. inspect the full boundary;
4. sample authorised access and recent changes;
5. examine visitor and maintenance entry;
6. test an alarm or monitoring process;
7. observe working practices; and
8. verify closure of previous issues.

Useful questions include:

• What information or service makes this area sensitive?
• Who approves access, and how is continued need reviewed?
• How are lost badges and terminated users handled?
• What happens when a visitor, cleaner or engineer enters?
• Which alerts require action, and where is that action recorded?
• How do safety and emergency arrangements interact with security?
• When was the zone last reassessed after a building or process change?

Interpret the result

A pass would show justified zoning, intact boundaries, controlled entry, proportionate monitoring, understood working rules and consistent operating records. A partial result might show strong doors and access technology but stale user lists or poorly governed visitor access. A fail could involve routinely shared credentials, unmonitored emergency access, an incomplete perimeter or repeated alarms without response.

Avoid judging only visual neatness. A room may look secure while former personnel retain access. Conversely, a simple locked archive can be effective when its risk is low, keys are controlled and records demonstrate consistent operation.

ISO describes ISO/IEC 27002 as guidance for establishing, implementing and improving information-security controls. Use that guidance with the organisation’s risk assessment. The objective is not to build the most fortified room; it is to create a physical protection system whose strength matches the information and services inside.